aZTF: A Human-Governed Framework for Automated Zero Trust

Three market drivers, used here as defined working terms, bear on how organizations assemble and govern work. Emergent Compute is workload-level capability assembled from eligible heterogeneous resources, across a distributed estate or within a fixed sovereign footprint. Agentic Ops is multi-step operational work performed through agents under human authority, runtime constraints, observation, review and recovery. Tokenomics is the economics of acquiring and using AI capability across token-metered services, other consumption models and owned infrastructure, evaluated as cost per accepted outcome. Together they strain Zero Trust because a task can outlive its initial permission. Its purpose, acceptance criteria, data rights, delegation or curated context may change while automated work is under way. This paper proposes aZTF (Automated Zero Trust Framework), a framework connecting a human-governed lifecycle, automated enforcement and verifiable assurance. All three stay under continuing human governance (HGC³AE²). A declared contract turns material change into reevaluation, pause or escalation. Reconstruction of history is kept apart from rehydration, which requires fresh authority. Enforcement operates inside a human-approved delegation envelope, so per-action approval is not required, and automation never widens its own authority. Assurance keeps authority, dispatch, acknowledgement and acceptance records distinct from independent observation of an action's effect. Legion is proposed as the physically segregated mechanism applying approved administrative decisions on inventoried infrastructure at A1, the autonomous control plane layer. Native resource and workflow owners keep their own enforcement. The comparator is a strongly configured composition of NIST Zero Trust controls, Agentic Trust Framework (ATF) controls, Autonomous Action Runtime Management (AARM) action-mediation requirements and provenance records. If that composition delivers equivalent accepted outcomes at no greater counted cost, with permitted work still completing, aZTF's added value is not demonstrated. No test has been run, and the paper establishes no implementation, risk reduction, compliance or originality.